3 ms·

Even that is not sufficient short of a full factory reset. It can be very difficult to impossible to clear all caches and logs, or even know about them. Once t

Even that is not sufficient short of a full factory reset. It can be very difficult to impossible to clear all caches and logs, or even know about them. Once the agent has your password and takes the device into their back room for an hour, you have to assume that all data has been offloaded and the device has had an undetectable rootkit added. This gentleman's expertise is in security and encryption and now he works for Apple, a company that makes products that the US government can't always crack. He was clearly targeted in his encounter because of his current position, based on the questions they were asking. Surreptitious access to his devices is highly desirable to US intelligence services. Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards.

archgoon 8y ago
> Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards. Seems unwise to destroy evidence. Find the rootkit, or have your employer or security researcher do so, prove it's existence, and sue the Government. But yes, definitely get a new laptop.
- 0xDEFC0DE 8y ago
  I don't think that will go anywhere. How do you prove the government did it and that it wasn't on there before the encounter?
  - satokema 8y ago
    Why do you need proof? Show it to the internet, there should be other examples too. It's way easier and less legally ambiguous to make people THINK you are rooting their devices than to actually do it and leave actual evidence to be found. They could even be looking for OTHER rootkits instead of installing them. I suspect there's a lot of availability bias going on here as well - how many travelers go through the US per year versus how many of them are famous ex-CTOs that get reposted on HN?
  - inetknght 8y ago
    image the device prior and after; compare images

archgoon 8y ago

> Any device that you lose physical control of during these encounters must be presumed to be compromised and should be physically destroyed afterwards. Seems unwise to destroy evidence. Find the rootkit, or have your employer or security researcher do so, prove it's existence, and sue the Government. But yes, definitely get a new laptop.

0xDEFC0DE 8y ago
I don't think that will go anywhere. How do you prove the government did it and that it wasn't on there before the encounter?
- satokema 8y ago
  Why do you need proof? Show it to the internet, there should be other examples too. It's way easier and less legally ambiguous to make people THINK you are rooting their devices than to actually do it and leave actual evidence to be found. They could even be looking for OTHER rootkits instead of installing them. I suspect there's a lot of availability bias going on here as well - how many travelers go through the US per year versus how many of them are famous ex-CTOs that get reposted on HN?
- inetknght 8y ago
  image the device prior and after; compare images